Privacy Policy

1. About simlir

simlir is a product data API. We maintain a structured product database and provide access to it via a REST API and an MCP server for integrations. This privacy policy covers the simlir website (simlir.com), the simlir API, and the simlir B2B dashboard.

2. What We Collect

Public website visitors

When you visit simlir.com (including the /demo page), we collect:

• Optional page-view and interaction analytics via Google Analytics and Vercel Web Analytics, loaded only after an explicit analytics or performance choice. Browser Global Privacy Control and Do Not Track signals are treated as opt-outs. These providers may process pseudonymous browser, device, route, and country signals.
• Optional performance metrics via Vercel Speed Insights, loaded only after the performance choice.

Today we do not use advertising pixels, social media tracking tags, or browser fingerprinting on the public website.

API customers (B2B)

When you create a simlir account via the B2B dashboard, we collect:

• Email address and name (via Google OAuth)
• Company name (optional, entered by you)
• API usage logs: endpoint, timestamp, status/error, credit cost, response time, and bounded request metadata such as market, query/identifier, and image host. MCP image logs retain only the host, not the image URL path or query string. API keys and Authorization headers are not stored in this log.
• When the optional developer-funnel measurement flag is enabled after its reviewed migration, privacy-minimal milestone events such as account creation, key creation, successful requests, playground use, demo success, and purchases may be recorded. This ledger excludes raw queries, URLs, API keys, IP addresses, user agents, and browser identifiers.
• Payment information processed securely by Stripe (we do not store card details)
• Billing profile details supplied at checkout, such as billing country, address, customer type, and an optional VAT or tax number
• Billing lifecycle events and source-separated credit grants needed to provide subscriptions, invoices, rollover, refunds, and audit history

Product-search data sent to a partner catalogue

When the partner product catalogue connection is enabled, Simlir's text and image discovery searches across REST, hosted MCP, SDKs, framework integrations and the dashboard playground send bounded query text, selected market and applicable filters to the partner catalogue for additional product matches. Image searches may also send a bounded copy of the image content when it is safely available to the service. The request is made even when Simlir already has matching products. Simlir relevance-checks and deduplicates the two result sets, then returns matches in one shared format without an item-level provider label; merchant names and retailer links remain visible product information. Partner matches are returned for that request only and are not imported into, cached in, or indexed in Simlir's product catalogue. Simlir does not use those matches to train, fine-tune, or improve AI models. The selected market defaults the merchant shipping-origin filter; it does not confirm delivery. Avoid including personal or sensitive information in a product search. The partner catalogue handles requests under its own terms and privacy information. If it is unavailable or rate-limits a request, Simlir returns any available Simlir results.

3. How We Use Data

• To provide and improve the simlir API and product database
• To bill API customers accurately based on credit usage
• To monitor service health and detect abuse
• To measure aggregate developer onboarding and channel effectiveness without storing raw request content
• To maintain and describe our data quality standards in our public developer documentation

We never sell personal data. Aggregate, anonymised API usage statistics may be used internally to improve the product.

4. Third-Party Services

Simlir uses the following third-party services and product sources. The optional measurement providers are consent-gated through the site's Privacy choices control. Their delivery, retention, international transfers, and live configuration remain subject to the applicable provider terms and Simlir's reviewed privacy arrangements:

• Supabase, database hosting and authentication
• Vercel, website hosting, analytics, speed monitoring
• Google Analytics, optional, consent-gated website analytics
• Stripe, payment processing (B2B dashboard only)
• Google OAuth, sign-in for B2B dashboard and staff portal
• Partner product catalogue, receives bounded text, market, filter, and where applicable image inputs from enabled REST, hosted MCP, SDK, framework and dashboard product searches, then returns additional matches in the same product format. Partner results are not imported into Simlir's stored catalogue.
• Sentry, error monitoring (no personal data sent)

Each service has its own privacy policy. Simlir does not represent that one repository control certifies compliance in every jurisdiction; the applicable controller/processor roles, lawful basis, transfer mechanism, retention, and regional requirements require ongoing legal and provider review.

5. Cookies

The simlir public website offers separate optional analytics and performance purposes. Both are denied by default, and their provider adapters are mounted only after the relevant choice is granted. Browser-level opt-out signals are honored conservatively by keeping optional providers disabled. If analytics is accepted, Google Analytics may set a first-party cookie such as _ga with a pseudonymous identifier. You can reopen Privacy choices at any time to withdraw or change optional measurement. This implementation is a technical control, not a certification of legal compliance in every jurisdiction.

The B2B dashboard uses a session cookie set by Supabase Auth to keep you signed in.

We do not use advertising cookies, social tracking cookies, or browser fingerprinting.

6. Your Rights (UK GDPR)

Under the UK General Data Protection Regulation, you have the right to access, correct, and delete your personal data. If you have a B2B dashboard account, you can request deletion of your account and associated data by contacting us.

Public-site providers may process pseudonymous or device-related measurement signals only when their optional purpose is enabled. We do not use that statement to promise that no provider data exists; consult the provider disclosures and contact us for a rights request.

7. Data Retention

Product data (specs, prices, embeddings) is retained indefinitely as it is the core asset of our service. This data is sourced from public retailer pages and contains no personal information.

B2B account data and API usage logs are retained for the duration of your account plus 12 months after account closure, or as required by law.

Optional first-party developer-funnel milestones follow the same account-retention boundary when enabled, with aggregate anonymous demo milestones retained only for operational measurement. Financial and billing records may be retained for the applicable accounting, tax, fraud-prevention, dispute, and legal periods. The exact retention schedule and lawful-basis wording remain subject to legal and provider review.

8. Contact

For any privacy-related questions, contact us at privacy@simlir.com.

9. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated “Last updated” date. Continued use of simlir after changes constitutes acceptance of the revised policy.